notchecked

2023-10-15T17:57:56+00:00

Mounting service account tokens inside pods can provide an avenue for privilege escalation attacks where an attacker is able to compromise a single pod in the cluster.

medium

notchecked

2023-10-15T17:57:56+00:00

Kubernetes provides a default service account which is used by cluster workloads where no specific service account is assigned to the pod. Where access to the Kubernetes API from a pod is required, a specific service account should be created for that pod, and rights granted to that service account. This increases auditability of service account rights and access making it easier and more accurate to trace potential malicious behaviors to a specific service account and project.

medium

pass

2023-10-15T17:57:56+00:00

Enabling the admission control plugin AlwaysAdmit allows all requests and does not provide any filtering.

medium

oval:ssg-api_server_admission_control_plugin_alwaysadmit:def:1

compliance

Disable the AlwaysAdmit Admission Control Plugin

In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#ffe65d9fac11909686e59349c6a0111aaf57caa26bd2db3e7dcb1a0a22899145' at path '.apiServerArguments["enable-admission-plugins"][:]' all: value equals '^AlwaysAdmit$'

Compliance class describes OVAL Definitions that check to see if a system's state is compliant with a specific policy. An evaluation result of "true", for this class of OVAL Definitions, indicates that a system is compliant with the stated policy.

1

pass

2023-10-15T17:57:56+00:00

Setting admission control policy to AlwaysPullImages forces every new pod to pull the required images every time. In a multi-tenant cluster users can be assured that their private images can only be used by those who have the credentials to pull them. Without this admission control policy, once an image has been pulled to a node, any pod from any user can use it simply by knowing the image’s name, without any authorization check against the image ownership. When this plug-in is enabled, images are always pulled prior to starting containers, which means valid credentials are required. However, turning on this admission plugin can introduce new kinds of cluster failure modes. OpenShift 4 master and infrastructure components are deployed as pods. Enabling this feature can result in cases where loss of contact to an image registry can cause a redeployed infrastructure pod (oauth-server for example) to fail on an image pull for an image that is currently present on the node. We use PullIfNotPresent so that a loss of image registry access does not prevent the pod from starting. If it becomes PullAlways, then an image registry access outage can cause key infrastructure components to fail. The pull policy can be managed per container, using imagePullPolicy.

high

oval:ssg-api_server_admission_control_plugin_alwayspullimages:def:1

compliance

Ensure that the Admission Control Plugin AlwaysPullImages is not set

In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#ffe65d9fac11909686e59349c6a0111aaf57caa26bd2db3e7dcb1a0a22899145' at path '.apiServerArguments["enable-admission-plugins"][:]' all: value equals '^AlwaysPullImages$'

Compliance class describes OVAL Definitions that check to see if a system's state is compliant with a specific policy. An evaluation result of "true", for this class of OVAL Definitions, indicates that a system is compliant with the stated policy.

1

pass

2023-10-15T17:57:56+00:00

Setting admission control policy to NamespaceLifecycle ensures that objects cannot be created in non-existent namespaces, and that namespaces undergoing termination are not used for creating new objects. This is recommended to enforce the integrity of the namespace termination process and also for the availability of new objects.

medium

oval:ssg-api_server_admission_control_plugin_namespacelifecycle:def:1

compliance

Enable the NamespaceLifecycle Admission Control Plugin

In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#54842ba5cf821644f2727625c1518eba2de6e6b7ae318043d0bf7ccc9570e430' at path '.apiServerArguments["enable-admission-plugins"][:]' at least one: value equals '^NamespaceLifecycle$'

Compliance class describes OVAL Definitions that check to see if a system's state is compliant with a specific policy. An evaluation result of "true", for this class of OVAL Definitions, indicates that a system is compliant with the stated policy.

1

pass

2023-10-15T17:57:56+00:00

Using the NodeRestriction plugin ensures that the kubelet is restricted to the Node and Pod objects that it could modify as defined. Such kubelets will only be allowed to modify their own Node API object, and only modify Pod API objects that are bound to their node.

medium

oval:ssg-api_server_admission_control_plugin_noderestriction:def:1

compliance

Enable the NodeRestriction Admission Control Plugin

In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#54842ba5cf821644f2727625c1518eba2de6e6b7ae318043d0bf7ccc9570e430' at path '.apiServerArguments["enable-admission-plugins"][:]' at least one: value equals '^NodeRestriction$'

Compliance class describes OVAL Definitions that check to see if a system's state is compliant with a specific policy. An evaluation result of "true", for this class of OVAL Definitions, indicates that a system is compliant with the stated policy.

1

pass

2023-10-15T17:57:56+00:00

A Security Context Constraint is a cluster-level resource that controls the actions which a pod can perform and what the pod may access. The SecurityContextConstraint objects define a set of conditions that a pod must run with in order to be accepted into the system. Security Context Constraints are comprised of settings and strategies that control the security features a pod has access to and hence this must be used to control pod access permissions.

medium

oval:ssg-api_server_admission_control_plugin_scc:def:1

compliance

Enable the SecurityContextConstraint Admission Control Plugin

In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#54842ba5cf821644f2727625c1518eba2de6e6b7ae318043d0bf7ccc9570e430' at path '.apiServerArguments["enable-admission-plugins"][:]' at least one: value equals '^security.openshift.io/SecurityContextConstraint$'

Compliance class describes OVAL Definitions that check to see if a system's state is compliant with a specific policy. An evaluation result of "true", for this class of OVAL Definitions, indicates that a system is compliant with the stated policy.

1

pass

2023-10-15T17:57:56+00:00

When a pod is created, if a service account is not specified, the pod is automatically assigned the default service account in the same namespace. OpenShift operators should create unique service accounts and let the API Server manage its security tokens.

medium

oval:ssg-api_server_admission_control_plugin_service_account:def:1

compliance

Enable the ServiceAccount Admission Control Plugin

In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#54842ba5cf821644f2727625c1518eba2de6e6b7ae318043d0bf7ccc9570e430' at path '.apiServerArguments["enable-admission-plugins"][:]' at least one: value equals '^ServiceAccount$'

Compliance class describes OVAL Definitions that check to see if a system's state is compliant with a specific policy. An evaluation result of "true", for this class of OVAL Definitions, indicates that a system is compliant with the stated policy.

1

pass

2023-10-15T17:57:56+00:00

When enabled, requests that are not rejected by other configured authentication methods are treated as anonymous requests. These requests are then served by the API server. If you are using RBAC authorization, it is generally considered reasonable to allow anonymous access to the API Server for health checks and discovery purposes, and hence this recommendation is not scored. However, you should consider whether anonymous discovery is an acceptable risk for your purposes.

medium

oval:ssg-api_server_anonymous_auth:def:1

compliance

Ensure that anonymous requests to the API Server are authorized

In the YAML/JSON file '/apis/rbac.authorization.k8s.io/v1/clusterrolebindings' at path '.items[:]['subjects'][:].name' at least one: value equals 'system:unauthenticated'

Compliance class describes OVAL Definitions that check to see if a system's state is compliant with a specific policy. An evaluation result of "true", for this class of OVAL Definitions, indicates that a system is compliant with the stated policy.

1

pass

2023-10-15T17:57:56+00:00

The APIPriorityAndFairness feature gate enables the use of the FlowSchema API objects which enforce a limit on the number of events that the API Server will accept in a given time slice In a large multi-tenant cluster, there might be a small percentage of misbehaving tenants which could have a significant impact on the performance of the cluster overall. It is recommended to limit the rate of events that the API Server will accept.

medium

oval:ssg-api_server_api_priority_gate_enabled:def:1

compliance

Enable the APIPriorityAndFairness feature gate

In the YAML/JSON file '/apis/operator.openshift.io/v1/kubeapiservers/cluster' at path '.spec.observedConfig.apiServerArguments["feature-gates"][:]' all: value equals '^APIPriorityAndFairness=true$'

Compliance class describes OVAL Definitions that check to see if a system's state is compliant with a specific policy. An evaluation result of "true", for this class of OVAL Definitions, indicates that a system is compliant with the stated policy.

1

pass

2023-10-15T17:57:57+00:00

OpenShift automatically rotates the log files. Retaining old log files ensures OpenShift Operators will have sufficient log data available for carrying out any investigation or correlation. For example, if the audit log size is set to 100 MB and the number of retained log files is set to 10, OpenShift Operators would have approximately 1 GB of log data to use during analysis.

low

oval:ssg-api_server_audit_log_maxbackup:def:1

compliance

Configure the Kubernetes API Server Maximum Retained Audit Logs

In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#54842ba5cf821644f2727625c1518eba2de6e6b7ae318043d0bf7ccc9570e430' at path '.apiServerArguments["audit-log-maxbackup"][:]' at least one: value equals '10'

Compliance class describes OVAL Definitions that check to see if a system's state is compliant with a specific policy. An evaluation result of "true", for this class of OVAL Definitions, indicates that a system is compliant with the stated policy.

1

pass

2023-10-15T17:57:57+00:00

OpenShift automatically rotates log files. Retaining old log files ensures that OpenShift Operators have sufficient log data available for carrying out any investigation or correlation. If you have set file size of 100 MB and the number of old log files to keep as 10, there would be approximately 1 GB of log data available for use in analysis.

medium

oval:ssg-api_server_audit_log_maxsize:def:1

compliance

Configure Kubernetes API Server Maximum Audit Log Size

In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#54842ba5cf821644f2727625c1518eba2de6e6b7ae318043d0bf7ccc9570e430' at path '.apiServerArguments["audit-log-maxsize"][:]' at least one: value equals '100'

Compliance class describes OVAL Definitions that check to see if a system's state is compliant with a specific policy. An evaluation result of "true", for this class of OVAL Definitions, indicates that a system is compliant with the stated policy.

1

pass

2023-10-15T17:57:57+00:00

Auditing of the Kubernetes API Server is not enabled by default. Auditing the API Server provides a security-relevant chronological set of records documenting the sequence of activities that have affected the system by users, administrators, or other system components.

high

oval:ssg-api_server_audit_log_path:def:1

compliance

Configure the Audit Log Path

In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#54842ba5cf821644f2727625c1518eba2de6e6b7ae318043d0bf7ccc9570e430' at path '.apiServerArguments["audit-log-path"][:]' at least one: value equals '.+'

Compliance class describes OVAL Definitions that check to see if a system's state is compliant with a specific policy. An evaluation result of "true", for this class of OVAL Definitions, indicates that a system is compliant with the stated policy.

1

pass

2023-10-15T17:57:57+00:00

The API Server, can be configured to allow all requests. This mode should not be used on any production cluster.

medium

oval:ssg-api_server_auth_mode_no_aa:def:1

compliance

The authorization-mode cannot be AlwaysAllow

In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#ffe65d9fac11909686e59349c6a0111aaf57caa26bd2db3e7dcb1a0a22899145' at path '.apiServerArguments["authorization-mode"][:]' all: value equals 'AlwaysAllow'

Compliance class describes OVAL Definitions that check to see if a system's state is compliant with a specific policy. An evaluation result of "true", for this class of OVAL Definitions, indicates that a system is compliant with the stated policy.

1

pass

2023-10-15T17:57:57+00:00

Role Based Access Control (RBAC) allows fine-grained control over the operations that different entities can perform on different objects in the cluster. Enabling RBAC is critical in regulating access to an OpenShift cluster as the RBAC rules specify, given a user, which operations can be executed over a set of namespaced or cluster-wide resources.

medium

oval:ssg-api_server_auth_mode_rbac:def:1

compliance

Ensure authorization-mode RBAC is configured

In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#54842ba5cf821644f2727625c1518eba2de6e6b7ae318043d0bf7ccc9570e430' at path '.apiServerArguments["authorization-mode"][:]' at least one: value equals 'RBAC'

Compliance class describes OVAL Definitions that check to see if a system's state is compliant with a specific policy. An evaluation result of "true", for this class of OVAL Definitions, indicates that a system is compliant with the stated policy.

1

pass

2023-10-15T17:57:57+00:00

Basic authentication uses plaintext credentials for authentication. Currently the basic authentication credentials last indefinitely, and the password cannot be changed without restarting the API Server. The Basic Authentication is currently supported for convenience and is not intended for production workloads.

medium

oval:ssg-api_server_basic_auth:def:1

compliance

Disable basic-auth-file for the API Server

In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#54842ba5cf821644f2727625c1518eba2de6e6b7ae318043d0bf7ccc9570e430' at path '.apiServerArguments[:]' all: key 'basic-auth-file' value equals ''

Compliance class describes OVAL Definitions that check to see if a system's state is compliant with a specific policy. An evaluation result of "true", for this class of OVAL Definitions, indicates that a system is compliant with the stated policy.

1

pass

2023-10-15T17:57:57+00:00

The OpenShift API server is served over HTTPS with authentication and authorization; the secure API endpoint is bound to 0.0.0.0:6443 by default. In OpenShift, the only supported way to access the API server pod is through the load balancer and then through the internal service. The value is set by the bindAddress argument under the servingInfo parameter.

low

oval:ssg-api_server_bind_address:def:1

compliance

Ensure that the bindAddress is set to a relevant secure port

In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#54842ba5cf821644f2727625c1518eba2de6e6b7ae318043d0bf7ccc9570e430' at path '.servingInfo["bindAddress"]' all: value equals '(.+)'

Compliance class describes OVAL Definitions that check to see if a system's state is compliant with a specific policy. An evaluation result of "true", for this class of OVAL Definitions, indicates that a system is compliant with the stated policy.

1

pass

2023-10-15T17:57:57+00:00

API Server communication contains sensitive parameters that should remain encrypted in transit. Configure the API Server to serve only HTTPS traffic. If -clientCA is set, any request presenting a client certificate signed by one of the authorities in the client-ca-file is authenticated with an identity corresponding to the CommonName of the client certificate.

medium

oval:ssg-api_server_client_ca:def:1

compliance

Configure the Client Certificate Authority for the API Server

In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#d56e72c377d8f85e0601a704d4218064a0ea4a2235ceee82d20db6cdafc74608' at path '[:]' all: value equals '(.*?)'

Compliance class describes OVAL Definitions that check to see if a system's state is compliant with a specific policy. An evaluation result of "true", for this class of OVAL Definitions, indicates that a system is compliant with the stated policy.

1

fail

2023-10-15T17:57:57+00:00

etcd is a highly available key-value store used by OpenShift deployments for persistent storage of all REST API objects. These objects are sensitive in nature and should be encrypted at rest to avoid any disclosures. Where etcd encryption is used, it is important to ensure that the appropriate set of encryption providers is used. Currently, aescbc is the only type supported by OCP.

medium

oval:ssg-api_server_encryption_provider_cipher:def:1

compliance

Configure the Encryption Provider Cipher

In the YAML/JSON file '/apis/config.openshift.io/v1/apiservers/cluster#a1d4b20a86b76e7e2d634dbeff420b1a80df6800836dad1b552314d1b24a18cb' at path '[:]' all: value equals 'aescbc|aesgcm'

Compliance class describes OVAL Definitions that check to see if a system's state is compliant with a specific policy. An evaluation result of "true", for this class of OVAL Definitions, indicates that a system is compliant with the stated policy.

1

pass

2023-10-15T17:57:57+00:00

etcd is a highly-available key-value store used by OpenShift deployments for persistent storage of all REST API objects. These objects are sensitive in nature and should be protected by client authentication. This requires the API Server to identify itself to the etcd server using a SSL Certificate Authority file.

medium

oval:ssg-api_server_etcd_ca:def:1

compliance

Configure the etcd Certificate Authority for the API Server

In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#33769e7a3c14dd6dc237eb2b13a72140eeadf2ce49578f57bc9e0fd096cf4e9a' at path '[:]' all: value equals '(.*?)'

Compliance class describes OVAL Definitions that check to see if a system's state is compliant with a specific policy. An evaluation result of "true", for this class of OVAL Definitions, indicates that a system is compliant with the stated policy.

1

pass

2023-10-15T17:57:57+00:00

etcd is a highly-available key-value store used by OpenShift deployments for persistent storage of all REST API objects. These objects are sensitive in nature and should be protected by client authentication. This requires the API Server to identify itself to the etcd server using a client certificate and key.

medium

oval:ssg-api_server_etcd_cert:def:1

compliance

Configure the etcd Certificate for the API Server

In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#54842ba5cf821644f2727625c1518eba2de6e6b7ae318043d0bf7ccc9570e430' at path '.apiServerArguments["etcd-certfile"][:]' all: value equals '.*\.crt'

Compliance class describes OVAL Definitions that check to see if a system's state is compliant with a specific policy. An evaluation result of "true", for this class of OVAL Definitions, indicates that a system is compliant with the stated policy.

1

pass

2023-10-15T17:57:57+00:00

etcd is a highly-available key-value store used by OpenShift deployments for persistent storage of all REST API objects. These objects are sensitive in nature and should be protected by client authentication. This requires the API Server to identify itself to the etcd server using a client certificate and key.

medium

oval:ssg-api_server_etcd_key:def:1

compliance

Configure the etcd Certificate Key for the API Server

In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#54842ba5cf821644f2727625c1518eba2de6e6b7ae318043d0bf7ccc9570e430' at path '.apiServerArguments["etcd-keyfile"][:]' all: value equals '.*\.key'

Compliance class describes OVAL Definitions that check to see if a system's state is compliant with a specific policy. An evaluation result of "true", for this class of OVAL Definitions, indicates that a system is compliant with the stated policy.

1

pass

2023-10-15T17:57:57+00:00

Connections from the kube-apiserver to kubelets could potentially carry sensitive data such as secrets and keys. It is thus important to use in-transit encryption for any communication between the apiserver and kubelets.

medium

oval:ssg-api_server_https_for_kubelet_conn:def:1

compliance

Ensure that the --kubelet-https argument is set to true

In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#54842ba5cf821644f2727625c1518eba2de6e6b7ae318043d0bf7ccc9570e430' at path '.apiServerArguments[:]' all: key 'kubelet-https' value equals ''

Compliance class describes OVAL Definitions that check to see if a system's state is compliant with a specific policy. An evaluation result of "true", for this class of OVAL Definitions, indicates that a system is compliant with the stated policy.

1

pass

2023-10-15T17:57:57+00:00

If the API Server is bound to an insecure address the installation would be susceptible to unauthenticated and unencrypted access to the master node(s). The API Server does not perform authentication checking for insecure binds and the traffic is generally not encrypted.

medium

oval:ssg-api_server_insecure_bind_address:def:1

compliance

Disable Use of the Insecure Bind Address

In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#95b5b27bb6ea2b122e810c99c17c2430c4845596942804847dd677557cfed88e' at path '.apiServerArguments[:]' all: value equals 'insecure-bind-address'

Compliance class describes OVAL Definitions that check to see if a system's state is compliant with a specific policy. An evaluation result of "true", for this class of OVAL Definitions, indicates that a system is compliant with the stated policy.

1

notapplicable

2023-10-15T17:57:57+00:00

Configuring the API Server on an insecure port would allow unauthenticated and unencrypted access to your master node(s). It is assumed firewall rules will be configured to ensure this port is not reachable from outside the cluster, however as a defense in depth measure, OpenShift should not be configured to use insecure ports.

medium

oval:ssg-api_server_insecure_port:def:1

compliance

Prevent Insecure Port Access

In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#54842ba5cf821644f2727625c1518eba2de6e6b7ae318043d0bf7ccc9570e430' at path '.apiServerArguments["insecure-port"][:]' all: value equals '0'

Compliance class describes OVAL Definitions that check to see if a system's state is compliant with a specific policy. An evaluation result of "true", for this class of OVAL Definitions, indicates that a system is compliant with the stated policy.

1

pass

2023-10-15T17:57:57+00:00

Connections from the API Server to the kubelet are used for fetching logs for pods, attaching (through kubectl) to running pods, and using the kubelet port-forwarding functionality. These connections terminate at the kubelet HTTPS endpoint. By default, the API Server does not verify the kubelet serving certificate, which makes the connection subject to man-in-the-middle attacks, and unsafe to run over untrusted and/or public networks.

high

oval:ssg-api_server_kubelet_certificate_authority:def:1

compliance

Configure the kubelet Certificate Authority for the API Server

In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#1118b118fc93b557cda9eb3f29584d2f92f5c3976f77dec35848eb54e0d819cc' at path '[:]' all: value equals '(.*?)'

Compliance class describes OVAL Definitions that check to see if a system's state is compliant with a specific policy. An evaluation result of "true", for this class of OVAL Definitions, indicates that a system is compliant with the stated policy.

1

pass

2023-10-15T17:57:57+00:00

By default the API Server does not authenticate itself to the kubelet's HTTPS endpoints. Requests from the API Server are treated anonymously. Configuring certificate-based kubelet authentication ensures that the API Server authenticates itself to kubelets when submitting requests.

high

oval:ssg-api_server_kubelet_client_cert:def:1

compliance

Configure the kubelet Certificate File for the API Server

In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#e5500055b4aa2fcf00dc09ad0e66e44b6b42d67f8d53d1e72ff81b32f0e09865' at path '[:]' all: value equals '(.*?)'

Compliance class describes OVAL Definitions that check to see if a system's state is compliant with a specific policy. An evaluation result of "true", for this class of OVAL Definitions, indicates that a system is compliant with the stated policy.

1

notapplicable

2023-10-15T17:57:57+00:00

By default the API Server does not authenticate itself to the kubelet's HTTPS endpoints. Requests from the API Server are treated anonymously. Configuring certificate-based kubelet authentication ensures that the API Server authenticates itself to kubelets when submitting requests.

high

oval:ssg-api_server_kubelet_client_cert_pre_4_9:def:1

compliance

Configure the kubelet Certificate File for the API Server

In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config' at path '.data["config.yaml"]' all: value equals '"kubelet-client-certificate":\["/etc/kubernetes/static-pod-resources/secrets/kubelet-client/tls.crt"\]'

Compliance class describes OVAL Definitions that check to see if a system's state is compliant with a specific policy. An evaluation result of "true", for this class of OVAL Definitions, indicates that a system is compliant with the stated policy.

1

pass

2023-10-15T17:57:57+00:00

By default the API Server does not authenticate itself to the kubelet's HTTPS endpoints. Requests from the API Server are treated anonymously. Configuring certificate-based kubelet authentication ensures that the API Server authenticates itself to kubelets when submitting requests.

high

oval:ssg-api_server_kubelet_client_key:def:1

compliance

Configure the kubelet Certificate Key for the API Server

In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config#1e2b7c1158e0b9a602cb20d62c82b4660907bb57b63dac11c6c7c64211c49c69' at path '[:]' all: value equals '(.*?)'

Compliance class describes OVAL Definitions that check to see if a system's state is compliant with a specific policy. An evaluation result of "true", for this class of OVAL Definitions, indicates that a system is compliant with the stated policy.

1

notapplicable

2023-10-15T17:57:57+00:00

By default the API Server does not authenticate itself to the kubelet's HTTPS endpoints. Requests from the API Server are treated anonymously. Configuring certificate-based kubelet authentication ensures that the API Server authenticates itself to kubelets when submitting requests.

high

oval:ssg-api_server_kubelet_client_key_pre_4_9:def:1

compliance

Configure the kubelet Certificate Key for the API Server

In the YAML/JSON file '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config' at path '.data["config.yaml"]' all: value equals '"kubelet-client-key":\["/etc/kubernetes/static-pod-resources/secrets/kubelet-client/tls.key"\]'

Compliance class describes OVAL Definitions that check to see if a system's state is compliant with a specific policy. An evaluation result of "true", for this class of OVAL Definitions, indicates that a system is compliant with the stated policy.

1

pass

2023-10-15T17:57:57+00:00

Connections between the kube-apiserver and the extension openshift-oauth-apiserver could potentially carry sensitive data such as secrets and keys. It is important to use in-transit encryption for any communication between the kube-apiserver and the extension openshift-apiserver.

medium

oval:ssg-api_server_oauth_https_serving_cert:def:1

compliance

Ensure the openshift-oauth-apiserver service uses TLS

TLS security profile configured must use secure protocols in OpenShift OAuth API Server

Compliance class describes OVAL Definitions that check to see if a system's state is compliant with a specific policy. An evaluation result of "true", for this class of OVAL Definitions, indicates that a system is compliant with the stated policy.

1

pass

2023-10-15T17:57:57+00:00

Connections between the kube-apiserver and the extension openshift-apiserver could potentially carry sensitive data such as secrets and keys. It is important to use in-transit encryption for any communication between the kube-apiserver and the extension openshift-apiserver.

medium

oval:ssg-api_server_openshift_https_serving_cert:def:1

compliance

Ensure the openshift-oauth-apiserver service uses TLS

TLS security profile configured must use secure protocols in OpenShift API Server

Compliance class describes OVAL Definitions that check to see if a system's state is compliant with a specific policy. An evaluation result of "true", for this class of OVAL Definitions, indicates that a system is compliant with the stated policy.

1

pass

2023-10-15T17:57:57+00:00

Profiling allows for the identification of specific performance bottlenecks. It generates a significant amount of program data that could potentially be exploited to uncover system and program details. To ensure the collected data is not exploited, profiling endpoints are secured via RBAC (see cluster-debugger role). By default, the profiling endpoints are accessible only by users bound to cluster-admin or cluster-debugger role. Profiling can not be disabled.

medium

oval:ssg-api_server_profiling_protected_by_rbac:def:1

compliance

Profiling is protected by RBAC

In the YAML/JSON file '/apis/rbac.authorization.k8s.io/v1/clusterroles/cluster-debugger' at path '.rules[0].nonResourceURLs[:]' at least one: value equals '\/metrics'

Compliance class describes OVAL Definitions that check to see if a system's state is compliant with a specific policy. An evaluation result of "true", for this class of OVAL Definitions, indicates that a system is compliant with the stated policy.

1

pass

2023-10-15T17:57:57+00:00

Setting global request timeout allows extending the API Server request timeout limit to a duration appropriate to the user's connection speed. By default, it is set to 1800 seconds which might not be suitable for some environments. Setting the limit too low may result in excessive timeouts, and a limit that is too large may exhaust the API Server resources making it prone to Denial-of-Service attack. It is recommended to set this limit as appropriate and change the default limit of 1800 seconds only if needed.